Reload tls_client_ca_file on SIGHUP
Author: brickmonsterCreated Sep 16, 2026Updated Sep 16, 2026
Is your feature request related to a problem? Please describe. Bootstrapping vault.
- Start vault with temporary dummy certificates.
- Generate real certificates with vault.
- Replace temporary certificates at the same path.
- Reload.
Describe the solution you'd like
Reload the file at tls_client_ca_file like tls_cert_file and tls_key_file.
Describe alternatives you've considered Full restart + unseal
Additional context
For tls_cert_file/tls_key_file there's some conflicting docs:
"SIGHUP will not reload your TLS configuration."
"On SIGHUP, the path set here at Vault startup will be used for reloading the certificate"
From a robot:
Empirically confirmed, with a double dissociation:
1. Baseline: real PKI client cert → 200.
2. Replaced only the on-disk tls_client_ca_file with a rogue CA (verified on disk), sent SIGHUP — Vault logged Vault reload triggered.
3. Real PKI cert (trusted only by the in-memory CA now) → still 200. If the file had been reloaded, this must fail.
4. Rogue cert (trusted only by the on-disk file) → rejected, server logged failed to verify certificate. If the file had been reloaded, this must succeed.
5. Restored the real CA, reloaded, 200 again.
So SIGHUP reloads the server cert/key but not tls_client_ca_fileSource: hashicorp/vault